RHSA-2020:0860HighCVSS 7.6

Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 8 security update

Published
March 17, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (4)

CVE-2019-0221 →CVE-2019-12418 →CVE-2019-17563 →CVE-2020-1938 →

📋 Description

CVE-2019-0221 — tomcat: XSS in SSI printenv CVE-2019-12418 — tomcat: local privilege escalation CVE-2019-17563 — tomcat: Session fixation when using FORM authentication CVE-2020-1938 — tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

🎯 Affected products1

  • Red Hat JBoss Web Server 3.1

✅ Remediation

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). The References section of this erratum contains a download link (you must log in to download the update). Workaround: SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website. Workaround: Disable JMX Remote if monitoring is only needed locally and there is no need to monitor Tomcat remotely. If JMX Remote is required and cannot be disabled, then use the built-in remote JMX facilities provided by the JVM. Please note that JMX Remote Lifecycle Listener is now deprecated and may be removed from both Tomcat 7 [1] and Tomcat 9 [2] after 2020-12-31. [1] https://tomcat.apache.org/tomcat-7.0-doc/config/listeners.html#Deprecated_Implementations [2] https://tomcat.apache.org/tomcat-9.0-doc/config/listeners.html#Deprecated_Implementations Workaround: Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251

🔗 References (9)